Task support system and method

ABSTRACT

A task support system and method improve an operator&#39;s handling of an unknown new event. The task support system and method handle an event that occurred in a management target, in relation to an unknown event, and one or more event types are evaluated as event type candidates. A first event type candidate group having a high confidence score among the evaluated event type candidates is extracted and a first candidate confidence score is calculated from each confidence score of each event type candidate of the first event type candidate group. A first candidate importance is calculated from first importance held by an event type corresponding to each event type candidate belonging to the first event type candidate group and information other than the first importance. A diagram corresponding to each event is represented in a coordinate space by using the first candidate confidence score and the first candidate importance.

CROSS-REFERENCE TO RELATED APPLICATION

The present application claims priority from Japanese applicationJP2019-168723, filed on Sep. 17, 2019, the contents of which is herebyincorporated by reference into this application.

TECHNICAL FIELD

The present invention relates to a task support system and method whichcan be suitably applied, for example, to event handling task support ofsupporting the handling of event information generated by anapplication.

BACKGROUND ART

Conventionally, there was a system which displayed an event generated byan application on a screen, together with its importance, as describedin PTL 1. When this kind of technology is applied to a system in which aplurality of application products coexist, because the standard ofimportance differs for each application, it was necessary to define theimportance from the perspective of a system separate from the importancegenerated by the application. By providing an “event type list”, thefollowing system for realizing the foregoing configuration wasconsidered. Note that “event type” refers to the categorized type aftercategorizing past events. Various methods may be considered as themethod of categorization, and an example thereof will be explainedlater. Moreover, one or more event types indicated in a tabular formatare hereinafter referred to as an “event type list”.

In this system, when an event such as an error occurs, the applicationgenerates event information including a message describing the detailsof that event.

Moreover, a management device which manages the events of theapplication (this is hereinafter referred to as the “event managementdevice”) holds a list in which event master information of events thatoccur in the application to be managed is registered (this ishereinafter referred to as the “event type list”). Here, “event masterinformation” refers to information including the event type ID, amessage template indicating the template of the message to be includedin the event information, and importance of the event type. In theensuing explanation, an event registered in the event type list isreferred to as a “known event”.

When the event management device receives event information of an eventthat newly occurred, the event management device reads the messageincluded in the received event information (this is hereinafter referredto as the “new event”), evaluates an event type of the same type as thenew event among the known events registered in the event type list, andproposes the event master information to the operator. In the ensuingexplanation, this evaluated event type is referred to as the “event typecandidate”. Moreover, in the ensuing explanation, the act of evaluatingthe event type candidate is referred to as “allocating the event typecandidate”. As the method of evaluation, there is, for example, a methodof performing morphological analysis to the “message of the event” andthe “message template of the event type” of a certain event, and deemingthe event type having high similarity as the “event type candidate”.Here, the index indicating the possibility that each event typecandidate is the correct event type is hereinafter referred to as a“confidence score”. As the confidence score, for instance, the foregoingsimilarity is used.

An operator can thereby handle a new event by referring to the eventmaster information.

CITATION LIST Patent Literature

[PTL 1] Japanese Unexamined Patent Application Publication No.2003-186704

SUMMARY OF THE INVENTION Problems to be Solved by the Invention

In the foregoing device, it may not necessarily be possible to specifythe event type candidates of one event to one event type, and aplurality of event types may exist as the event type candidates. In theforegoing case, such event type candidates are proposed to the operator,and the operator feedbacks the correct event type among the event typecandidates. Based on the operator's foregoing operation, the eventmanagement device can allocate the new event with the event type list.Here, the importance of the associated event type is hereinafterreferred to as the “true importance” of the corresponding event.

When there are a plurality of new events and it is therefore necessaryto have the operator feedback the correct answers among the plurality ofnew events, the order that the operator feedbacks the correct answers isimportant, but it is difficult to determine that order. This is because,while the correct answers should be determined in order from the newevent having the highest true importance, the true importance is stillunknown.

While it is also possible to consider a system in which the eventmanagement device deems the importance of the event type of the firstcandidate among a plurality of event type candidates as “provisionalimportance” and displays a list in order of provisional importance, andthe operator thereby feedbacks the correct answers in the displayedorder, if the first candidate evaluated by the event management deviceis incorrect, there is a problem in that the feedback of the correctanswers of the important event will be postponed. In other words, withthis system, there is a problem in that information for evaluating theimportance of each new event cannot be provided to the operator.

Furthermore, because the operator cannot evaluate the importance of eachnew event, there is a problem in that the order of handling the newevents cannot be identified.

Moreover, there may be multiple criteria of importance. For example,while an event in which the operational continuity of the system islost, such as an unplanned system halt caused by the operator'soperation error, is an important event for the system administrator, theleakage of customer information due to an intrusion by a cracker is animportant event for the security administrator. When there are multiplecriteria of importance for one event as explained above, there is aproblem in that such multiple criteria of importance cannot beidentified with a conventional system.

The present invention was devised in view of the foregoing points, andan object of this invention is to propose a highly useful task supportsystem and method capable of proposing the evaluated importance andconfidence score of an unknown new event to the operator, and improvingthe safety of the operator's handling of the unknown new event.

Means to Solve the Problems

In order to achieve the foregoing object, the present invention providesa task support system which supports handling of an event that occurredin a management target, comprising: an event type evaluation unit whichevaluates, in relation to an unknown event, one or more event types ofthe event as event type candidates; a first calculation unit whichextracts a first event type candidate group having a high confidencescore among the evaluated event type candidates, calculates a firstcandidate confidence score from each confidence score in each of theevent type candidates of the extracted first event type candidate group,and calculates first candidate importance from first importance held byan event type corresponding to each event type candidate belonging tothe first event type candidate group and information other than thefirst importance; and a representation unit which represents a diagramcorresponding to each of the events in a coordinate space by using thefirst candidate confidence score and the first candidate importance.

Moreover, the present invention additionally provides a task supportmethod executed by a task support system which supports handling of anevent that occurred in a management target, comprising: a first step ofevaluating, in relation to an unknown event, one or more event types ofthe event as event type candidates; a second step of extracting a firstevent type candidate group having a high confidence score among theevaluated event type candidates, calculating a first candidateconfidence score from each confidence score in each event type candidateof the extracted first event type candidate group, and calculating firstcandidate importance from first importance held by an event typecorresponding to each event type candidate belonging to the first eventtype candidate group and information other than the first importance;and a third step of representing a diagram corresponding to each of theevents in a coordinate space by using the first candidate confidencescore and the first candidate importance.

According to the task support system and method of the presentinvention, the operator can handle an unknown new event whileidentifying the confidence score and importance based on the analysisscreen proposed from the event analyzing device. Thus, according to thetask support system and method of the present invention, it is possibleto improve the safety in the operator's handling of an unknown newevent.

Advantageous Effects Of The Invention

According to the present invention, it is possible to realize a highlyuseful task support system and method.

BRIEF DESCRIPTION OF DRAWINGS

FIG. 1 is a block diagram showing the overall configuration of the eventhandling task support system according to the first and secondembodiments.

FIG. 2 is a diagram showing a screen configuration example of the newevent analysis screen according to the first embodiment.

FIG. 3 is a diagram showing a configuration example of the event typelist according to the first embodiment.

FIG. 4 is a diagram showing a configuration example of the event table.

FIG. 5 is a diagram showing a configuration example of the allocationresult table.

FIG. 6 is a flowchart showing the processing routine of the eventhandling task support processing.

FIG. 7 is a flowchart showing the processing routine of the drawingprocessing.

FIG. 8 is a flowchart showing the processing routine of the coordinatedetermination processing.

FIG. 9 is a flowchart showing the processing routine of the node drawingprocessing according to the first embodiment.

FIGS. 10A and 10B are diagrams explaining the coordinate determinationprocessing.

FIG. 11 is a diagram explaining the coordinate determination processing.

FIG. 12 is a flowchart showing the processing routine of therecommendation arrow drawing processing.

FIGS. 13A and 13B are diagrams explaining the recommendation arrowdrawing processing.

FIG. 14 is a diagram showing a screen configuration example of the newevent analysis screen according to the second embodiment.

FIG. 15 is a diagram showing a configuration example of the event typelist according to the second embodiment.

FIG. 16 is a flowchart showing the processing routine of the nodedrawing processing according to the second embodiment.

FIG. 17 is a diagram showing a pie-shaped representation method in thefirst embodiment.

FIG. 18 is a block diagram showing the overall configuration of theevent handling task support system according to the second embodiment.

FIG. 19 is a diagram showing another screen configuration example of thenew event analysis screen according to the first embodiment.

DESCRIPTION OF EMBODIMENTS

An embodiment of the present invention is now explained in detail withreference to the appended drawings.

(1) First embodiment

(1-1) Configuration of Event Handling Task Support System According tothis Embodiment

In FIG. 1, reference numeral 1 represents the overall event handlingtask support system according to this embodiment. The event handlingtask support system 1 is configured by comprising one or more eventgeneration servers 2 provided respectively in correspondence with theapplications and apparatuses of the management target, an eventmanagement server 4 connected to each event generation server 2 via afirst network 3, one or more event analyzing servers 6 connected to theevent management server 4 via a second network 5, one or more operatorterminals 8 connected to each event analyzing server 6 via a thirdnetwork 7, and a database server 10 connected to the event analyzingserver 6 via a fourth network 9.

The event generation server 2 is a server device having a function ofgenerating event information, when some kind of event occurs in thecorresponding application, according to such event, and sending thegenerated event information to the event management server 4 via thefirst network 3.

Moreover, the event management server 4 sends the event information sentfrom each event generation server 2 to the event analyzing server 6 viathe second network 5.

The event analyzing server 6 is a server device equipped with the eventhandling task support function explained later, and is configured bycomprising information processing resources such as a CPU (CentralProcessing Unit) 20, a storage device 21 and a communication device 22.

The CPU 20 is a processor which governs the operational control of theoverall event analyzing server 6. Moreover, the storage device 21 isconfigured, for example, from a semiconductor memory and a hard diskdevice, and is used for storing and retaining necessary programs anddata. The event reception program 23, the event type candidateallocation program 24 and the node drawing program 25 explained laterare also stored and retained in the storage device 21.

The communication device 22 is configured, for example, from an NIC(Network Interface Card), and performs protocol control duringcommunication with the event management server 4, the operator terminal8 or the database server 10 via the second to fourth networks 5, 7, 9.

The operator terminal 8 is a computer device that is used by the systemadministrator, the security administrator or the operator (worker) toactually handle a new event that occurred, and displays the new eventanalysis screen 40 explained later with reference to FIG. 2 based on thescreen data sent from the event analyzing server 6 as explained later.

The database server 10 is a server device which stores and retainsvarious types of information required for the event analyzing server 6to generate the new event analysis screen 40, and is configured bycomprising a large-capacity nonvolatile storage device 30 such as a harddisk device, an SSD (Solid State Drive) or a flash memory. The storagedevice 30 of the database server 10 stores and retains the event typelist 31, the event table 32, the allocation result table 33 and thelearning model 34 explained later.

(1-2) Event Handling Tasksupport Function According to this Embodiment

The event handling task support function equipped in the event analyzingserver 6 of the event handling task support system 1 is now explained.The event handling task support function is a function which analyzeseach event information sent from the event management server 4,generates the new event analysis screen 40 shown in

FIG. 2 based on the analysis, and displays the generated new eventanalysis screen 40 on the operator terminal 8.

Each time the event analyzing server 6 receives event information, theevent analyzing server 6 sequentially compares the message indicatingthe details of the new event that occurred based on the text informationincluded in the event information with the message template based on thetext information included in the event master information of each knownevent registered in the event type list 31 of the database server 10,and calculates, for each known event, the similarity level of thecontents of the message template based on the text information includedin the event master information in comparison to the details of themessage based on the text information included in the event informationof the new event (this is hereinafter referred to as the “confidencescore”).

Subsequently, the event analyzing server 6 extracts, from the event typelist 31, all known events in which the confidence score is equal to orgreater than a predetermined threshold (this is hereinafter referred toas the “confidence score threshold”) based on the confidence score foreach calculated known event, and allocates the extracted known events tothe new event as the event type candidates.

If all of the known events were less than the confidence scorethreshold, a message to such effect is displayed on the operatorterminal 8. The operator feedback one of the known events, or inputs amessage to the effect of being a new event as well as the importancethereof. When a message to the effect of being a new event is input, theevent analyzing server 6 adds one line of the following contents to theevent type list 31 explained later with reference to FIG. 3 incorrespondence with the relevant event. The contents of the line to beadded shall be as follows; namely, the event type ID (31A) shall be anumber that is newly numbered, the message template 31B shall be a copyof the message of the line of the new event of the event table 32, andthe corresponding line of the importance 31C of the event type list 31shall be the importance input by the operator.

Moreover, the event analyzing server 6 generates the new event analysisscreen 40 as shown in FIG. 2 based on the allocation result of the eventtype candidate to the new event. The event analyzing server 6 displaysthe new event analysis screen 40 on the operator terminal 8 by sendingthe screen data of the generated new event analysis screen 40 to therelevant operator terminal 8 via the third network 7.

Here, the new event analysis screen 40 is configured by comprising, asshown in FIG. 2, plane coordinates 41 in which the vertical axis takeson the importance and the horizontal axis takes on the confidence score.Displayed on the plane coordinates 41 are each new event among the newevents corresponding respectively to each event information previouslyreceived by the event analyzing server 6 which has not yet been handledby the operator, and the nodes 42 corresponding respectively thereto.

These node 42 are configured from a circle graph of a predetermined sizewherein, as the central coordinate, used is the xy coordinate in whichthe confidence score of the event type candidate having the largestconfidence score among the event type candidates allocated to therespectively corresponding new events is indicated as the x coordinate,and the importance pre-set by the user to the event type candidate asexplained later is indicated as the y coordinate. Otherwise, the maximumconfidence score of one or more event type candidates in which theconfidence score is equal to or greater than the threshold may beindicated as the x coordinate, and the maximum importance may beindicated as the y coordinate.

Furthermore, with this circle graph, an existence ratio of the eventtype candidates in which the importance is set to a high value (forexample, “80” or higher), the event type candidates in which theimportance is set to a medium value (for example, “30” to “79”), and theevent type candidates in which the importance is set to a low value (forexample, “29” or less) among the event type candidates allocated to thecorresponding to new event is represented in a size of the central angleof the area in which such importance is associated respectively to“high”, “medium” and “low”.

Moreover, displayed on the plane coordinates 41 is an arrow (this ishereinafter referred to as the “recommendation arrow”) 43 representingthe recommended order that the operator should handle the new eventscorresponding respectively to the nodes 42 existing on the planecoordinates 41.

The recommendation arrow 43 is displayed between the relevant nodes 42so as to indicate the order of the respective nodes from the node 41 ofa new event having a high priority to the node 41 of a new event havinga low priority based on the priority of the new events determined basedon the importance set to each event type candidate allocated to the newevent corresponding to that node 42 and the confidence score calculatedfor each of such event type candidates.

The operator is thereby able to handle the new events in order from thenew event having a higher priority by handling the new eventscorresponding respectively to the nodes 42 in the order indicated by therecommendation arrow 42 displayed on the new event analysis screen 40.

As the means for the realizing the foregoing event handling task supportfunction according to this embodiment, as shown in FIG. 1, the storagedevice 21 (FIG. 1) of the event analyzing server stores an eventreception program 23, an event type candidate allocation program 24 anda node drawing program 25, and the storage device 30 of the databaseserver 10 stores an event type list 31, an event table 32, an allocationresult table 33 and a learning model 34.

The event reception program 23 is a program having a function ofreceiving the event information of each new event sent from the eventmanagement server 4, and sequentially registering the received eventinformation in the event table 32 of the database server 10.

Moreover, the event type candidate allocation program 24 is a programhaving a function of extracting a known event having a similar messageamong the known events registered in the event type list 31 andallocating such extracted known event, as an event type candidate, toeach new event registered in the event table 32, and registering theallocation result in the allocation result table 33. In this embodiment,while the confidence score is calculated by performing morphologicalanalysis to the messages and calculating the similarity thereof, theconfidence score may also be calculated by using machine learning. Inthe foregoing case, the event type candidate allocation program 24 isequipped with a function of performing machine learning to the eventtype candidate to be allocated to the new event by using the learningmodel 34 stored in the database server 10.

The node drawing program 25 is a program with a function of generatingscreen data of the new event analysis screen 40 based on the importanceand other factors of each event type candidate allocated to each newevent by the event type candidate allocation program 24, and sending thescreen data of the generated new event analysis screen 40 to theoperator terminal 8 via the third network 7. As explained above, the newevent analysis screen 40 is displayed on the operator terminal 8 basedon the foregoing screen data.

Meanwhile, the event type list 31 is a list for managing and holding theevent master information of previously registered known events and has atable configuration comprising, as shown in FIG. 3, at least an eventtype ID column 31A, a message template column 31B and an importancecolumn 31C. In the event type list 31, one line corresponds to one knownevent.

The event type ID column 31A stores an event type ID which is unique inthe event type list 31 and assigned to the corresponding known event.Moreover, the message template column 31 B stores, as a messagetemplate, text information of a message included in the eventinformation sent from the event management server 4 (FIG. 1) when acorresponding known event has occurred, and the importance column 31Cstores the importance of the corresponding known event pre-set by theoperator to such known event.

Accordingly, in the example of FIG. 3, for example, with regard to theknown event to which an event type ID of “1000” has been assigned, textinformation of a message to the effect of “application server (***)stopped abnormally” is included in the event information received by theevent analyzing server 6 when such known event has occurred, and theimportance of such known event has been set to “90” by the operator.

The event table 32 is a table that is used for managing the eventinformation of the new event and is configured by comprising, as shownin FIG. 4, at least an event ID column 32A and a message column 32B. Inthe event table 32, one line corresponds to one new event which has notyet been handled by the operator.

The event ID column 32A stores a numbered event ID which is unique inthe event table 32 each time a new event arrives, and the message column32B stores text information of a message representing the details of thenew event which was included in the event information.

Accordingly, in the example of FIG. 4, the message representing thedetails of the new event based on the text information included in theevent information of the new event to which an event ID of “0001” hasbeen assigned is “application server (Nagoya) stopped abnormally”.

The allocation result table 33 is a table that is used for managing theevent type candidates allocated to each new event and the confidencescore thereof, and is configured by comprising, as shown in FIG. 5, anevent ID column 33A, an event type ID column 33B and a confidence scorecolumn 33C. In the allocation result table 33, one line corresponds toone event type candidate allocated to one new event registered in theevent table 32 (FIG. 4).

The event ID column 33A stores the event ID of a new event that isregistered in the event table 32 and which has not yet been handled, andthe event type ID column 33B stores one event type ID of the event typecandidate (known event) allocated to that new event. Moreover, theconfidence score column 33C stores a confidence score, which is acalculated value regarding the possibility that the new eventcorresponding to the event ID column 33A can be allocated to the eventtype corresponding to the event type ID column 33B.

Accordingly, in the example of FIG. 5, for example, at least three knownevents including a first known event to which an event type ID of “1000”has been assigned, a second known event to which an event type ID of“1001” has been assigned, and a third known event to which an event typeID of “1003” has been assigned are allocated, as the event typecandidates, to the new event to which an event ID of “0001” has beenassigned, and the confidence scores of the first to third known eventsare respectively “90”, “40” and “30”.

Note that, in the case of the event handling task support system 1, theentries of each new event in the event table 32 and the allocationresult table 33 are deleted from the event table 32 and the allocationresult table 33 once the handling of the new event by the operator iscompleted.

When the operator completes handling the new event for which a node 42has been displayed on the new event analysis screen 40, the operatorperforms an operation to input a message to such effect by using theoperator terminal 8. When the foregoing input operation is performed,the operator terminal 8 sends, to the event analyzing server 6, acommand identifying the new event for which the handling thereof hasbeen completed.

The node drawing program 24 of the event analyzing server 6 thatreceived the foregoing command erases the entries of the new eventidentified in such command from the event table 32 and the allocationresult table 33. Consequently, the node 42 corresponding to that newevent is no longer displayed on the new event analysis screen 40.

(1-3) Various Types of Processing Related to Event Handling Task SupportFunction According to this Embodiment

The specific processing contents of the various types of processing tobe executed by the event analyzing server 6 in relation to the foregoingevent handling task support function are now explained. Note that, inthe ensuing explanation, while the processing subject of the varioustypes of processing is explained as a “program”, it goes without sayingthat, in effect, the CPU 20 (FIG. 1) executes the processing based onsuch “program”.

(1-3-1) Flow of Event Handling Task Support Processing

FIG. 6 shows the flow of the series of processing (in the presentinvention, this is hereinafter referred to as the “event handling tasksupport processing”) to be executed by the event analyzing server 6 inrelation to the foregoing event handling task support function. Theevent handling task support processing is started when the operator,after the event analyzing server 6 is activated, operates the operatorterminal 8 and instructs the event analyzing server 6 to execute theevent handling task support processing.

When the event handling task support processing is started, the eventtype candidate allocation program 24 (FIG. 1) foremost selects one newevent among the new events registered in the event table 32 (FIG. 4)(S1).

Next, the event type candidate allocation program 24 allocates, as theevent type candidate(s), zero or more known events from the event typelist 31 to the new event selected in step S1 (this is hereinafterreferred to as the “selected new event”) (S2).

Specifically, the event type candidate allocation program 24, based onthe text information of the message representing the details of theselected new event included in the event information of the selected newevent, breaks down such message for each part of speech based onmorphological analysis, and vectorizes the characteristic amount of suchmessage by using methods such as N-gram processing or TF-IDF processingbased on such parts of speech that were broken down.

Moreover, the event type candidate allocation program 24, based on thetext information of the message representing the details of the knownevent included in the event master information of the respective knownevents registered in the event type list 31 (FIG. 3), vectorizes therespective characteristic amounts of such message according to the samemethod.

Subsequently, the event type candidate allocation program 24 compares,for each known event, the vector of the characteristic amount of themessage of the new event and the vector of the characteristic amount ofthe message of the corresponding known event, and calculates thedistance of the two vectors as the confidence score of that known event.

Subsequently, the event type candidate allocation program 24 extractsall known events in which the confidence score is equal to or greaterthan the foregoing confidence score threshold based on the confidencescore of each known event calculated pursuant to the foregoingprocessing, and allocates such extracted known events as the event typecandidates to the selected new event. Moreover, the event type candidateallocation program 24 registers the allocation result in the allocationresult table 33.

Subsequently, the event type candidate allocation program 24 calls thenode drawing program 25, and delivers the event ID of the selected newevent, as a parameter, to the node drawing program 25 (FIG. 1).

When the node drawing program 25 is called by the event type candidateallocation program 24, the node drawing program 25 searches for theevent type ID and the confidence score from the allocation result table32 with the event ID of the selected new event delivered from the eventtype candidate allocation program 24 as the search key, searches for theimportance registered in the event type list 31 with the event type IDdetected in the foregoing search as the search key, and executes thedrawing processing of drawing the foregoing nodes 42 corresponding tothe selected new events, as shown in FIG. 2, on the plane coordinates 41of the new event analysis screen 40 based on the foregoing information(S3). Details of this drawing processing will be explained later. Thenode drawing program 25 thereafter returns the processing to the eventtype candidate allocation program 24.

The event type candidate allocation program 24 to which the processingwas returned determines whether there is any new event to which an eventtype candidate has not yet been allocated among the new eventsregistered in the event table 32 (S4).

If there is an unprocessed event in step S4, the event type candidateallocation program 24 returns to step 51. Moreover, if an event typecandidate has been allocated to all new events registered in the eventtable 32 in step S4, the event type candidate allocation program 24calls the recommendation arrow drawing processing (S5).

Upon returning from the recommendation arrow drawing processing, theevent type candidate allocation program 24 enters a standby state ofwaiting for an input from the operator (S6). Specifically, the eventtype candidate allocation program 24 waits until an input is made by theoperator or another new event arrives. When an input is made by theoperator or another new event arrives, the event type candidateallocation program 24 advances the processing to step S7.

Moreover, the event type candidate allocation program 24 thereafterdeletes, from the plane coordinates 41, the node 42 corresponding to thenew event that has been handled by the operator among the respectivenodes 42 that were drawn on the plane coordinates 41 of the new eventanalysis screen 40 in step S3 (S7).

Subsequently, the event type candidate allocation program 24 determineswhether another new event, to which an event type candidate has not beenallocated, has been registered in the event table 32 (S8). When theevent type candidate allocation program 24 obtains a NO in the foregoingdetermination, the event type candidate allocation program 24 returns tostep S5, and thereafter repeats the processing of step S5 to step S8until a YES is obtained in step S8.

Meanwhile, when the event type candidate allocation program 24 obtains aYES in step S8 as a result of another new event, to which an event typecandidate has not been allocated, being registered in the event table32, the event type candidate allocation program 24 returns to step 51,and thereafter executes the processing of step S2 onward in the samemanner as explained above.

(1-3-2) Drawing Processing (1-3-2-1) Flow of Drawing Processing

FIG. 7 shows the specific processing contents of the drawing processingto be executed by the node drawing program 25 (FIG. 1) in step S3 of themaintenance handling task support processing explained above withreference to FIG. 6.

When the node drawing program 25 is called by the event type candidateallocation program 24, the node drawing program 25 starts the drawingprocessing shown in FIG. 7, and foremost executes the coordinatedetermination processing for determining the coordinate (centralcoordinate of the relevant node 42 in this example) on which should bedrawn the node 42 (FIG. 2) corresponding to the selected new event onthe plane coordinates 41 of the new event analysis screen 40 (S10).

Subsequently, the node drawing program 25 executes the node drawingprocessing of drawing the node 42 corresponding to the selected newevent centered around the coordinate determined in step S10 (S11). Basedon this node drawing processing, the node 42 corresponding to theselected new event is drawn on the plane coordinates 41 of the new eventanalysis screen 40 displayed on the operator terminal 8.

The node drawing program 25 thereafter ends the drawing processing, andreturns to step S4 of the event handling task support processing.

(1-3-2-2) Flow of Coordinate Determination Processing

FIG. 8 shows the specific processing contents of the coordinatedetermination processing to be executed by the node drawing program 25in step S10 of the drawing processing explained above with reference toFIG. 7.

When the node drawing program 25 proceeds to step S10 of the drawingprocessing, the node drawing program 25 starts the coordinatedetermination processing shown in FIG. 8, and foremost reads, from theevent type list 31 stored in the database server 10 (FIG. 1), the eventmaster information of each event type candidate allocated to theselected new event by the event type candidate allocation program 24(S20). Here, the maximum confidence score event type candidate to beused in step S23 is initialized to “no candidate”.

Subsequently, the node drawing program 25 selects one event typecandidate which has not yet undergone the processing of step S22 onwardamong the respective event type candidates in which the event masterinformation was read in step S20 (S21). Next, the node drawing program25 determines whether the confidence score of the event type candidateselected in step S21 is maximum among the event type candidates selectedin step S21 up until now. Specifically, the node drawing program 25determines that the confidence score is maximum when “the maximumconfidence score event type candidate indicated in step S23 is in aninitialized state” or “the confidence score of the event type candidateselected in step S21 is greater than the confidence score of the maximumconfidence score event type candidate indicated in step S23” (S22). Whenthe node drawing program 25 obtains a NO in the foregoing determination,the node drawing program 25 proceeds to step S24.

Meanwhile, when the node drawing program 25 obtains a YES in thedetermination of step S22, the node drawing program 25 stores the eventtype ID and the confidence score of the event type candidate selected instep S21 as the event type ID and the confidence score of the event typecandidate in which the confidence score is maximum (in the presentinvention, this is hereinafter referred to as the “maximum confidencescore event type candidate”) (S23).

Next, the node drawing program 25 determines whether the processing ofstep S21 to step S23 has been executed for all event type candidatesallocated to the selected new event (S24). When the node drawing program25 obtains a NO in the foregoing determination, the node drawing program25 returns to step S21, and thereafter repeats the processing of stepS21 to step S24 while sequentially switching the event type candidate tobe selected in step S21 to another event type candidate which has notyet undergone the processing of step S22 onward among the event typecandidates allocated to the selected new event.

Subsequently, when the node drawing program 25 obtains a YES in step S24as a result of the processing of step S22 to step S23 being executed forall event type candidates allocated to the selected new event, the nodedrawing program 25 determines the central coordinate of the node 42corresponding to the selected new event to be drawn on the planecoordinates 41 of the new event analysis screen 40 as the coordinateposition in which the value stored as the confidence score of themaximum confidence score event type candidate is indicated as the xcoordinate, and the importance stored in the corresponding line of theevent type list 31 regarding the maximum confidence score event typecandidate is indicated as the y coordinate (S25). The node drawingprogram 25 thereafter ends the coordinate determination processing, andreturns to step 510 of the drawing processing explained above withreference to FIG. 7.

(1-3-2-3) Flow of Node Drawing Processing

FIG. 9 shows the specific processing contents of the node drawingprocessing to be executed by the node drawing program 25 in step S11 ofthe drawing processing explained above with reference to FIG. 7.

When the node drawing program 25 advances to step S11 of the drawingprocessing, the node drawing program 25 starts the node drawingprocessing shown in FIG. 9, and foremost acquires, from the event typelist 31 (FIG. 1) of the database server 10 (FIG. 1), the importance ofeach event type candidate allocated to the selected new event (S30).

Subsequently, the node drawing program 25 classifies the importance ofeach event type candidate of the selected new event into the threecategories of “high”, “medium” and “low” based on the acquiredimportance (S31).

Specifically, the node drawing program 25 classifies, as shown in FIG.10A, an event type candidate in which the importance set by the user isequal to or greater than a predetermined first threshold (for example,“80”) as a category of “high” importance, an event type candidate inwhich the importance set by the user is less than the first thresholdand equal to or greater than a predetermined second threshold (forexample, “30”) as a category of “medium” importance, and an event typecandidate in which the importance set by the user is less than thesecond threshold as a category of “low” importance.

Subsequently, the node drawing program 25 calculates the content rate ofthe event type candidates for each category as shown in FIG. 10B (S32).Specifically, the node drawing program 25 calculates, for each category,the content rate of the event type candidates in such category as shownin the following formula:

[Math 1]

Content rate=(Σ confidence score in category/Σ certain factor)×100   (1)

so that the ratio of the sum of the confidence scores of all event typecandidates belonging to that category relative to the sum of theconfidence scores of all event type candidates allocated to the selectednew event is centupled.

Subsequently, the node drawing program 25 draws a node 42 (FIG. 2)represented with a circle graph of a given radius on the planecoordinates 41 (FIG. 2) of the new event analysis screen 40 (FIG. 2 andFIG. 19) with the coordinate determined based on the coordinatedetermination processing explained above with reference to FIG. 8 as thecentral coordinate (S33).

Here, the node drawing program 25, as shown in FIG. 11, multiplies thecentral angles α1, α2, α3 (each 360 degrees) of the respective areasAR1, AR2, AR3 in the nodes 42 corresponding respectively to the threecategories of “high”, “medium” and “low” importance by the content rateof the event type candidates in the corresponding category, divides theinside of the nodes 42 to become a value obtained by dividing themultiplication result by 100, and colors the areas AR1 to AR3 with acolor corresponding to such category or draws a pattern corresponding tosuch category in the areas AR1 to AR3.

The node drawing program 25 thereafter ends the node drawing processingand returns to the drawing processing explained above with reference toFIG. 7.

(1-3-2-4) Flow of Recommendation Arrow Drawing Processing

FIG. 12 shows the specific processing contents of the recommendationarrow drawing processing to be executed by the node drawing program 25in step S5 of the event handling task support processing explained abovewith reference to FIG. 6.

When the node drawing program 25 advances to step S5 of the eventhandling task support processing, the node drawing program 25 starts therecommendation arrow drawing processing shown in FIG. 12, and foremosterases the recommendation arrow 43 displayed on the plane coordinates 41(FIG. 2) of the new event analysis screen 40 (FIG. 2). Subsequently, thenode drawing program 25 performs step S40 to step S43 relation to eachnew event existing in the event table 32.

Specifically, the node drawing program 25 selects one new event whichhas not yet undergone the processing of step S41 onward among all newevents existing in the event table 32 (S40).

Subsequently, the node drawing program 25 acquires the importance of allevent type candidates allocated to the new event selected in step S40 byreading such importance from the event type list 31 (FIG. 3) of thedatabase server 10 (FIG. 1) (S41).

Next, the node drawing program 25 classifies each event type candidatein which the importance was acquired in step S41 into the threecategories of “high”, “medium” and “low” importance in the same manneras step S31 of FIG. 9 (S42). Moreover, the node drawing program 25thereafter calculates the priority of handling the new event selected instep S40 according to the following formula (S43).

[Math 2]

Priority=Σ (Σ importance×confidence score)×category coefficient   (2)

Specifically, the node drawing program 25 respectively multiplies theimportance and confidence score of the corresponding event typecandidate among the respective event type candidates of the new eventselected in step S40 for each event type candidate classified into thecategory of “high” importance.

Moreover, the node drawing program 25 multiplies the value, which isobtained by totaling the foregoing multiplication results, by thecategory coefficient (as defined below) set to the correspondingcategory (category of “high” importance) among the coefficients pre-setto each category as shown in FIG. 13A (this is hereinafter referred toas the “category coefficient”).

Furthermore, the node drawing program 25 performs similar computationfor each category of each event type candidate among the respectiveevent type candidates of such new event which is classified into thecategories of “medium” importance or “low” importance, and, as shown inFIG. 13B, calculates the value obtained by totaling all computationalresults of the three categories as the priority of that new event.

Subsequently, the node drawing program 25 determines whether theprocessing of step S41 to step S43 has been executed for all new eventsexisting in the event table 32 (S44). When the node drawing program 25obtains a NO in the foregoing determination, the node drawing program 25returns to step S40, and thereafter repeats the processing of step S40to step S44 while sequentially switching the new event to be selected instep S40 to another new event which has not yet undergone the processingof step S41 onward.

Meanwhile, when the node drawing program 25 obtains a YES in step S44 asa result of completing the calculation of priority of all new eventsexisting in the event table 32, the node drawing program 25 foremosterases all recommendation arrows on the screen (S45), and draws theforegoing recommendation arrow 43 between the respective correspondingnodes 42 on the plane coordinates 41 of the new event analysis screen 40based on the priority of each new event calculated in the mannerexplained above (S46).

Specifically, the node drawing program 25 sorts the respective newevents existing in the event table 32 in order from the new event havingthe highest priority, and draws the recommendation arrow 43 between therelevant nodes 42 so that the new events can be indicated in the sortedorder.

When the node drawing program 25 completes the drawing of allrecommendation arrows 43, the node drawing program 25 ends therecommendation arrow drawing processing, and returns to the drawingprocessing explained above with reference to FIG. 7.

Note that, in this embodiment, the processing of drawing therecommendation arrow 43 may be omitted. In the foregoing case, thedisplay format will be as shown in FIG. 19. FIG. 19 is configured in thesame manner as the new event analysis screen of FIG. 2 excluding thepoint that the recommendation arrow 43 is not displayed.

(1-4) Effect of this Embodiment

Accordingly, with the event handling task support system 1 of thisembodiment, the event analyzing server 6 analyzes the event informationof a new event provided from the event management server 4 and, in orderto enable the user to recognize, at a glance, the confidence score andimportance of the new event based on the analysis, the new eventanalysis screen 40, in which the nodes 42 corresponding respectively tothese new events are arranged on the plane coordinates 41, is generatedand displayed on the operator terminal.

Accordingly, by referring to the new event analysis screen 40, theoperator can immediately recognize the confidence score and importanceof an unknown new event. Furthermore, by displaying the order of newevents to be handled by the event analyzing server 6, the operator canhandle the new events in the proper order. Thus, according to thisembodiment, it is possible to realize a highly useful event handlingtask support system capable of improving the operator's safety inhandling an unknown new event.

(2) Second Embodiment

In FIG. 18, the event handling task support system 50 represents theoverall event handling task support system according to the secondembodiment. The event handling task support system 50 is configured inbasically the same manner as the event handling task support system 1 ofthe first embodiment excluding the point that the event analyzing server51 generates a new event analysis screen 60 as shown in FIG. 14 anddisplays the generated new event analysis screen 60 on the operatorterminal 8 in substitute for the new event analysis screen 40 explainedabove with reference to FIG. 2.

Specifically, in the case of the event handling task support system 50according to this embodiment, the event type list 52 stored in thestorage device 30 of the database server 10 is configured by comprising,as shown in FIG. 15, at least an event type ID column 52A and a messagetemplate column 52B, and a system importance column 52C and a securityimportance column 52D.

The event type ID column 52A and the message template column 52Brespectively store the same information as the information stored in theevent type ID column 31A or the message column 31 B of the event typelist 31 of the first embodiment explained above with reference to FIG.3.

Moreover, the system importance column 52C stores the importance interms of a system (this is hereinafter referred to as the “systemimportance”) as the first evaluation perspective of the correspondingknown event pre-set by the operator in the same manner as the“importance” of the first embodiment, and the security importance column52D stores the importance in terms of security (this is hereinafterreferred to as the “security importance”) as the second evaluationperspective of the known event pre-set by the operator in the samemanner.

Subsequently, the system analyzing server 51 allocates as the event typecandidates, to each new event registered in the event table 32, allknown events among the known events registered in the event type list 52in which the confidence score, which was calculated in the same manneras the first embodiment, is equal to or greater than the foregoingconfidence score threshold.

Moreover, the system analyzing server 51 generates the new eventanalysis screen 60 as shown in FIG. 14 based on the system importanceand the security importance of each event type candidate allocated toeach new event, and the confidence score. Subsequently, the eventanalyzing server 51 sends the screen data of the generated new eventanalysis screen 60 to the relevant operator terminal 8 via the thirdnetwork 7, and thereby displays the new event analysis screen 60 on theoperator terminal 8.

As shown in FIG. 14, the new event analysis screen 60 of this embodimentis configured by comprising plane coordinates 61 in which the verticalaxis takes on the security importance and the horizontal axis takes onthe system importance. Displayed on the plane coordinates 61 are eachnew event among the new events corresponding respectively to each eventinformation previously received by the event analyzing server 51 whichhas not yet been handled by the operator, and the nodes 62 correspondingrespectively thereto.

These nodes 62 are configured from a circle graph wherein, as thecentral coordinate, used is the xy coordinate in which the systemimportance acquired from the event type list 52 of the event typecandidate having the largest confidence score among the event typecandidates allocated to the respectively corresponding new events isindicated as the x coordinate, and the security importance acquired fromthe event type list 52 regarding such event type candidates is indicatedas the y coordinate.

In the foregoing case, the circle graph is drawn in a size (radius)which inversely relates to the confidence score of the event typecandidate having the highest confidence score among the event typecandidates allocated to the corresponding new event. Consequently, anode 62 corresponding to a new event having a low confidence scorebecomes notable as it will be displayed larger, and the operator canthereby preferentially handle the new event corresponding to that node62.

Moreover, in the circle graph, an event type candidate having thehighest security importance among the event type candidates allocated tothe corresponding new event is associated with the inner upper left area(this is hereinafter simply referred to as the “upper left area”), andan event type candidate having the highest system importance among theevent type candidates allocated to the corresponding new event isassociated with the inner lower right area (this is hereinafter simplyreferred to as the “lower right area”).

Specifically, according to which category among the three categories of“high”, “medium” and “low” the value of security importance of the eventtype candidate having the highest security importance belongs, the upperleft area of the circle graph is colored with a color corresponding tothe category to which such value belongs or a pattern is indicatedaccording to such category. For example, upon belonging to a category inwhich the security importance is “high” (for example, the foregoingvalue is “80” or higher), the upper left area is colored in red, uponbelonging to a category in which the security importance is “medium”(for example, the foregoing value is “30” to “79”), the upper left areais colored in orange, and upon belonging to a category in which thesecurity importance is “low” (for example, the foregoing value is “29”or less), the upper left area is colored in green.

Similarly, according to which category among the three categories of“high”, “medium” and “low” the value of system importance of the eventtype candidate having the highest system importance belongs, the lowerright area of the circle graph is colored with a color corresponding tothe category to which such value belongs or a pattern is indicatedaccording to such category.

Note that, in the example of FIG. 14, while only the nodes 62 aredisplayed on the plane coordinates of the new event analysis screen 60,in effect, the recommendation arrows 43 explained above with referenceto FIG. 2 may also be displayed in the same manner as the firstembodiment.

The specific processing contents of the series of processing (eventhandling task support processing) to be executed by the event analyzingserver 50 in relation to the event handling support function accordingto this embodiment are now explained. Note that, because the overallflow of the event handling task support processing of this embodiment isthe same as the event handling task support processing of the firstembodiment explained above with reference to FIG. 6, the explanationthereof is omitted.

Moreover, because the flow of the drawing processing to be executed bythe node drawing program 53 (FIG. 1) of this embodiment in step S3 (FIG.6) of the event handling task support processing is also the same as theflow of the drawing processing according to the first embodimentexplained above with reference to FIG. 7 excluding the processingcontents of the respective steps, the explanation thereof is omitted.

Moreover, because the flow of the respective steps of the coordinatedetermination processing (FIG. 8) as the processing contents of step S10is the same excluding the processing contents of step S25, theexplanation thereof is omitted.

The processing contents of step S25 are replaced as follows in thisembodiment. “The central coordinate is drawn by indicating the systemimportance of the maximum confidence score system type candidate as xand indicating the security importance of the maximum confidence scoresystem type candidate as y, and the radius shall be a value obtained bydividing a predetermined constant of the system by the confidence scoreof the maximum confidence score system type candidate.” These valueswill be used in step S57 explained later.

FIG. 16 shows the specific processing contents of the node drawingprocessing to be executed by the node drawing program 53 of thisembodiment in step S11 of the drawing processing of FIG. 7.

When the node drawing program 53 of this embodiment advances to step S11of the drawing processing, the node drawing program 53 starts the nodedrawing processing shown in FIG. 16, and foremost acquires, from theevent type list 52 of the database server 10, the event masterinformation of each event type candidate allocated to the new event(selected new event) selected in step S1 of FIG. 6. Furthermore, thenode drawing program 53 initializes the maximum system importance eventtype candidate to be used in step S53 and the maximum securityimportance event type candidate to be used in step S55 (S50).

Subsequently, the node drawing program 53 selects one event typecandidate which has not yet undergone the processing of step S52 onwardamong the respective event type candidates in which the event masterinformation was read in step S50 (S51). Moreover, the node drawingprogram 53 determines “whether the maximum system importance event typecandidate is in an initialized state, or whether the system importanceof the event type candidate selected in step S51 is maximum among theevent type candidates selected in step S51 up until now from the timethat the maximum system importance event type candidate was initializedin step S50” (S52). When the node drawing program 53 obtains a NO in theforegoing determination, the node drawing program 53 proceeds to stepS54.

Meanwhile, when the node drawing program 53 obtains a YES in thedetermination of step S52, the node drawing program 53 stores the eventtype ID and the system importance of the event type candidate selectedin step S51 as the system importance of the event type candidate inwhich the system importance is maximum (in the present invention, thisis hereinafter referred to as the “maximum system importance event typecandidate”) (S53).

Next, the node drawing program 53 determines “whether the maximumsecurity importance event type candidate is in an initialized state, orwhether the security importance of the event type candidate selected instep S51 is maximum among the event type candidates selected in step S51up until now from the time that the maximum security importance eventtype candidate was initialized in step S50” (S54). When the node drawingprogram 53 obtains a NO in the foregoing determination, the node drawingprogram 53 proceeds to step S56.

Meanwhile, when the node drawing program 53 obtains a YES in thedetermination of step S54, the node drawing program 53 stores the eventtype ID and the security importance of the event type candidate selectedin step S51 as the security importance of the event type candidate inwhich the security importance is maximum (in the present invention, thisis hereinafter referred to as the “maximum security importance eventtype candidate”) (S55).

Furthermore, the node drawing program 53 determines whether theprocessing of step S52 to step S55 has been executed for all event typecandidates allocated to the selected new event (S56). When the nodedrawing program 53 obtains a NO in the foregoing determination, the nodedrawing program 53 returns to step S51, and thereafter repeats theprocessing of step S51 to step S56 while sequentially switching theevent type candidate to be selected in step S51 to another event typecandidate which has not yet undergone the processing of step S52 onwardamong the event type candidates allocated to the selected new event.

When the node drawing program 53 obtains a YES in step S56 as a resultof completing the processing of step S52 to step S55 for all event typecandidates allocated to the selected new event, the node drawing program53 determines the central coordinate of the node 62 (FIG. 14)corresponding to the selected new event to be drawn on the planecoordinates 61 (FIG. 14) of the new event analysis screen 60 (FIG. 14)as the coordinate position in which the value calculated in step S25;that is, the value stored as the system importance of the maximum systemimportance event type candidate is indicated as the x coordinate, andthe security importance stored as the security importance of the maximumsecurity importance event type candidate is indicated as the ycoordinate, and draws, on the plane coordinates 61 (FIG. 14) of the newevent analysis screen 60 (FIG. 14), with the coordinate determined basedon the foregoing coordinate determination processing as the centralcoordinate, the nodes 62 represented with a circle having the radiusdetermined based on the foregoing coordinate determination processing inwhich the lower right half of the circle is drawn using a color or apattern corresponding to the system importance of the maximum systemimportance event type candidate calculated in step S53 and the upperleft half of the circle is drawn using a color or a patterncorresponding to the security importance of the maximum securityimportance event type candidate calculated in step S55 (S57). The nodedrawing program 53 thereafter ends the node drawing processing andreturns to “return” subsequent to step S11 of the drawing processingexplained above with reference to FIG. 7.

Note that, because the contents of the processing to be subsequentlyexecuted by the event analyzing server 51 are the same as firstembodiment, the explanation thereof is omitted.

Accordingly, with the event handling task support system 50 of thisembodiment, the event analyzing server 51 analyzes the event informationof a new event provided from the event management server 4 and, in orderto enable the user to recognize, at a glance, the importance from theperspective of a system and the importance from the perspective ofsecurity of the new event to be handled based on the analysis, the newevent analysis screen 60, in which the nodes 62 correspondingrespectively to these new events are arranged on the plane coordinates61, is generated and displayed on the operator terminal.

Accordingly, by referring to the new event analysis screen 60, theoperator can immediately recognize which new event is important from theperspective of a system and which new event is important from theperspective of security, and the operator can thereby properly handlethe new event. Thus, according to this embodiment, as with the firstembodiment, it is possible to realize a highly useful event handlingtask support system capable of improving the operator's safety inhandling an unknown new event.

(3) Other Embodiments

Note that while the foregoing first and second embodiments explained acase of arranging the event type list 31, 52, the event table 32, theallocation result table 33 and the learning model in the databaseserver, the present invention is not limited thereto, and, for example,the foregoing data may also be allocated to the event analyzing server6, 51.

Moreover, while the foregoing first and second embodiments explained acase of deleting the entries of each new event in the event table 32 andthe allocation result table 33 from the event table 32 and theallocation result table 33 after the operator's handling of the newevent is completed, the present invention is not limited thereto, andthe entries of the new event that was handled may be left as is withoutbeing deleted from the event table 32 and the allocation result table33. As a result of adopting the foregoing configuration, the operatorcan confirm past new events.

Furthermore, while the foregoing first embodiment explained a case wherethe node 42 performs drawing as explained above with reference to FIG.11, the present invention is not limited thereto, and the node 42 mayperform drawing, for example, as shown in FIG. 17. Specifically, drawingis performed in each of the pie-shaped areas obtained by dividing therespective areas in the node 42, which correspond respectively to theimportance “high” “medium” and “low”, by the number of event typecandidates corresponding to that node, in a radius according to theconfidence score, in the color of each importance, in ascending orderfrom the highest importance, and in ascending order from the highestconfidence score.

Furthermore, while the foregoing first and second embodiments explaineda case of calculating the importance (candidate importance) of the newevent based on the importance (importance, or system importance andsecurity importance) which is pre-set to the event type of each knownevent, the present invention is not limited thereto, and the importanceof the new event may also be calculated according other methods. Forexample, the importance of the new event may be calculated based on thefollowing formula:

[Math 3]

Priority=Σ (importance of event type×confidence score of event type)  (3)

INDUSTRIAL APPLICABILITY

The present invention can be broadly applied to a task support systemwhich supports the handling of a new event that occurred in themanagement target.

REFERENCE SIGNS LIST

1, 50 . . . event handling task support system, 2 . . . event generationserver, 4 . . . event management server, 6, 51 . . . event analyzingserver, 8 . . . operator terminal, database server, 20 . . . CPU, 21, 30. . . storage device, 24 . . . event type candidate allocation program,25, 53 . . . node drawing program, 31, 52 . . . event type list, 32 . .. event table, 33 . . . allocation result table, 40, 60 . . . new eventanalysis screen, 41, 61 . . . plane coordinates, 42, 62 . . . node, 43 .. . recommendation arrow.

1. A task support system which supports handling of events that occurredin a management target, comprising: an event type evaluation unit whichevaluates, in relation to an unknown event, one or more event types ofthe event as event type candidates; a first calculation unit whichextracts a first event type candidate group having a high confidencescore among the evaluated event type candidates, calculates a firstcandidate confidence score from a confidence score of each of the eventtype candidates of the extracted first event type candidate group, andcalculates first candidate importance from first importance held by anevent type corresponding to each of the event type candidates belongingto the first event type candidate group and information other than thefirst importance; and a representation unit which represents a diagramcorresponding to each of the events in a coordinate space by using thefirst candidate confidence score and the first candidate importance. 2.The task support system according to claim 1, wherein the representationunit represents the first candidate confidence score and the firstcandidate importance on two axes of a plane coordinate axis.
 3. The tasksupport system according to claim 1, further comprising: a secondcalculation unit which extracts a second event type candidate group,which includes event type candidates having a low confidence score,among the evaluated event type candidates, calculates a second candidateconfidence score from a confidence score of each of the event typecandidates belonging to the extracted second event type candidate group,and calculates second candidate importance from first importance of anevent type corresponding to each of the event type candidates belongingto the second event type candidate group, wherein the representationunit represents the diagram in a graphic format by using the secondcandidate confidence score and the second candidate importance.
 4. Thetask support system according to claim 1, wherein, upon drawing thediagram corresponding respectively to two or more of the events, therepresentation unit calculates a priority of each of the events based onthe first candidate confidence score and the first candidate importance,and draws arrows respectively between each of the diagrams whichindicate an order of each of the diagrams from the diagram correspondingto the event in which the priority is high to the diagram correspondingto the event in which the priority is low.
 5. The task support systemaccording to claim 3, wherein, upon drawing the diagram correspondingrespectively to two or more of the events, the representation unitcalculates a priority of each of the events based on the first candidateconfidence score and the first candidate importance and based on thesecond candidate confidence score and the second candidate importance,and draws arrows respectively between each of the diagrams whichindicate an order of each of the diagrams from the diagram correspondingto the event in which the priority is high to the diagram correspondingto the event in which the priority is low.
 6. The task support systemaccording to claim 1, further comprising: a third calculation unit,wherewith the event type candidate has second importance based on asecond evaluation perspective, which calculates third candidateimportance from second importance of an event type corresponding to eachof the event type candidates belonging to the first event type candidategroup, wherein the representation unit represents the diagram oncoordinates by using the first candidate confidence score, the firstcandidate importance, and the third candidate importance.
 7. The tasksupport system according to claim 6, wherein the representation unitsets the first candidate confidence score to be a size of the diagram,and represents the first candidate importance and the third candidateimportance on two axes of a coordinate axis.
 8. A task support methodexecuted by a task support system which supports handling of an eventthat occurred in a management target, comprising: a first step ofevaluating, in relation to an unknown event, one or more event types ofthe event as event type candidates; a second step of extracting a firstevent type candidate group having a high confidence score among theevaluated event type candidates, calculating a first candidateconfidence score from a confidence score of each of the event typecandidates of the extracted first event type candidate group, andcalculating first candidate importance from first importance held by anevent type corresponding to each of the event type candidates belongingto the first event type candidate group and information other than thefirst importance; and a third step of representing a diagramcorresponding to each of the unknown events in a coordinate space byusing the first candidate confidence score and the first candidateimportance.
 9. The task support method according to claim 8, wherein, inthe third step, the first candidate confidence score and the firstcandidate importance are represented on two axes of a plane coordinateaxis.
 10. The task support method according to claim 8, wherein, in thesecond step, a second event type candidate group, which includes eventtype candidates having a low confidence score, is extracted among theevaluated event type candidates, a second candidate confidence score iscalculated from a confidence score of each of the event type candidatesbelonging to the extracted second event type candidate group, and secondcandidate importance is calculated from first importance of an eventtype corresponding to each of the event type candidates belonging to thesecond event type candidate group, and wherein, in the third step, thediagram is represented in a graphic format by using the second candidateconfidence score and the second candidate importance.
 11. The tasksupport method according to claim 8, wherein, in the third step, upondrawing the diagram corresponding respectively to two or more of theevents, a priority of each of the events is calculated based on thefirst candidate confidence score and the first candidate importance, andarrows are drawn respectively between each of the diagrams whichindicate an order of each of the diagrams from the diagram correspondingto the event in which the priority is high to the diagram correspondingto the event in which the priority is low.
 12. The task support methodaccording to claim 10, wherein, in the third step, upon drawing thediagram corresponding respectively to two or more of the events, apriority of each of the events is calculated based on the firstcandidate confidence score and the first candidate importance and basedon the second candidate confidence score and the second candidateimportance, and arrows are drawn respectively between each of thediagrams which indicate an order of each of the diagrams from thediagram corresponding to the event in which the priority is high to thediagram corresponding to the event in which the priority is low.
 13. Thetask support method according to claim 8, wherein, in the second step,the event type candidate has second importance based on a secondevaluation perspective, and third candidate importance is calculatedfrom second importance of an event type corresponding to each of theevent type candidates belonging to the first event type candidate group,and wherein, in the third step, the diagram is represented oncoordinates by using the first candidate confidence score, the firstcandidate importance, and the third candidate importance.
 14. The tasksupport method according to claim 13, wherein a representation unit setsthe first candidate confidence score to be a size of the diagram, andrepresents the first candidate importance and the third candidateimportance on two axes of a coordinate axis.